Bumping version of httparty to ensure protection from CVE-2025-68696 (2nd approach)

[michelgoldstein]

Purpose

• https://nvd.nist.gov/vuln/detail/CVE-2025-68696
• In order to ensure that our clients will not accidentally pick a vulnerable version of httparty, we bump the minimum version of the library dependency to 0.23.3 (> 0.23.2 as defined in the CVE)

Summary

• Part of the fix to the vulnerability was to prevent overriding the base URL. Unfortunately we use that feature in our code to point some APIs to api.siftscience.com and others to api3.siftscience.com. Therefore it required a little bit more work to define multiple instances with different base URLs instead of a single one.
• This is different from the first approach to handle the ability to more directly modify the instance of HTTParty and change other parameters, like loggers. The initial approach would hide the underlying instances forcing us to control the exposed parameters (like timeout).

Testing

• Ran unit tests
• Ran integration tests against test account

Checklist

• The change was thoroughly tested manually
• The change was covered with unit tests
• The change was tested with real API calls (if applicable)
• Necessary changes were made in the integration tests (if applicable) - N/A
• New functionality is reflected in README - N/A